DNS Request Analysis for Detecting Data Leakage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems fail to detect or prevent information leakage through DNS requests due to their non-interference with normal network connections, allowing hackers or malicious programs to send sensitive data via DNS requests to remote hosts undetected.
Innovation Solution
An information leakage detection method using a network traffic analysis device equipped with a machine learning model that analyzes character distribution features of DNS requests to identify malicious activity, employing multiple classification rules to enhance detection efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network security systems do not block DNS requests and responses, then normal network connection of terminal devices is maintained, but information leakage cannot be detected or prevented
Solution Approach 1:
The patent segments DNS traffic analysis into multiple dimensional features: character distribution features (entropy, character types, length), domain name structure features (TLD, SLD, subdomain analysis), and request pattern features. This segmentation allows comprehensive detection of information leakage while preserving normal DNS functionality.
Solution Approach 2:
The patent transforms DNS request detection into a parameter-based analysis system, converting domain name characteristics into quantifiable features such as character entropy, length ratios, and distribution patterns. These parameter changes enable automated machine learning classification to distinguish malicious from normal DNS requests.
2Device complexity
If traditional network security systems are used, then system simplicity is maintained, but detection accuracy of malicious DNS requests is insufficient
Solution Approach 1:
The patent introduces a machine learning model as an intermediary between DNS traffic monitoring and security decision-making. This intermediary automatically analyzes multiple character distribution features and domain name patterns, providing accurate detection without requiring complex manual rule configurations, thus maintaining system simplicity while improving precision.
Solution Approach 2:
The patent replaces traditional mechanical security rule-based systems with a machine learning-based automated analysis system. Instead of manually configuring detection rules, the system uses algorithms to learn patterns from character distribution features and automatically classify DNS requests, improving detection accuracy while reducing operational complexity.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
An information leakage detection method and a device using the same are disclosed. The method includes the following steps. Network connection data of an electronic device (12) is obtained. Log data related to a (domain name system) DNS is extracted from the network connection data. A DNS request in the log data is analyzed to obtain multiple character distribution feature values according to an analysis result. The character distribution feature values reflect a character distribution status of a domain name in the DNS request under different classification rules. A machine learning model (202) determines whether the DNS request is a malicious DNS request (401) according to the character distribution feature values, and the malicious DNS request (401) is used to carry leaked data to a remote host (13).